feat: Add trust boundary support for service accounts and impersonation. #1778
Conversation
nbayati
changed the title
google/auth/credentials.py
Outdated
| raise NotImplementedError("_build_trust_boundary_lookup_url must be implemented") | ||
|
|
||
| @staticmethod | ||
| def _parse_trust_boundary(trust_boundary_string: str): |
There was a problem hiding this comment.
Thanks for catching this. It's no longer used so I went ahead and removed it.
There was a problem hiding this comment.
Can you handle feature gating the same way we do for pluggable auth? We should align this across all languages.
Also, please add the following test cases:
-
Please add a test scenario for both service_account.Credentials and impersonated_credentials.Credentials where a valid (non-noop) trust boundary is successfully fetched and cached on the first refresh. A second refresh should then mock a RefreshError from the lookup endpoint. The test should assert that no exception is raised and that the initially cached trust boundary data is preserved on the credentials object. This would validate the fallback logic in _refresh_trust_boundary.
-
Include explicit tests for both service_account.Credentials in tests/oauth2/test_service_account.py and impersonated_credentials.Credentials in tests/test_impersonated_credentials.py to confirm that the trust boundary lookup is skipped when the credential is instantiated with a non-default universe_domain. This ensures the check is correctly triggered by the concrete classes.
|
|
||
| request = google_auth_requests.Request() | ||
| try: | ||
| info = _metadata.get_service_account_info(request, "default") |
There was a problem hiding this comment.
@harkamaljot you had worked on optimizing this call somewhere else in the code recently. Can you PTAL at this method and see if there are any issues in doing this call or something can be optimized.
| default_scopes=self._default_scopes, | ||
| trust_boundary=trust_boundary, | ||
| ) | ||
| creds._universe_domain = self._universe_domain |
There was a problem hiding this comment.
why not initialize universe domain through the creds init
| self._trust_boundary["encodedLocations"] | ||
| == NO_OP_TRUST_BOUNDARY_ENCODED_LOCATIONS |
There was a problem hiding this comment.
can use _has_no_op_trust_boundary here?
design: go/trust-boundaries-auth-sdk-v2